#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "(?m)password\s+for\s+(?<user>\w+)\s+from\s+(?<source_IP>\d+\.\d+\.\d+\.\d+)\s+port\s+(?<port>\d+)\s+(?<protocol>\w+)"
Local $sString = "Jun 3 17:29:44 XXX sshd[9668]: Failed password for userXXX from 192.168.1.2 port 63568 ssh2" & @CRLF & _
"· host = 10.0.0.9" & @CRLF & _
"· source = /var/log/secure" & @CRLF & _
"· sourcetype = linux_secure" & @CRLF & _
"Jun 3 00:13:41 XXX sshd[18404]: Accepted password for userXXX from 192.168.3.4 port 60272 ssh2" & @CRLF & _
"· host = 10.0.0.9" & @CRLF & _
"· source = /var/log/secure" & @CRLF & _
"· sourcetype = linux_secure"
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYGLOBALFULLMATCH)
Local $aFullArray[0]
For $i = 0 To UBound($aArray) -1
_ArrayConcatenate($aFullArray, $aArray[$i])
Next
$aArray = $aFullArray
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm